Файловый менеджер - Редактировать - /opt/imh-python/lib/python3.9/site-packages/botocore/__pycache__/credentials.cpython-39.pyc
Ðазад
a p�h�> � @ s@ d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl m Z d dl m Z d dlmZ d dlmZmZ d dlZd dlZd dlmZ d dlmZ d d lmZ d d lmZ d d lm Z d d lm Z d d lm Z d dlm Z d dlm Z d dlm!Z! d dlm"Z" d dlm#Z# d dlm$Z$ d dl%m&Z&m'Z' d dl%m(Z( d dl%m)Z) d dl%m*Z* e�+e,�Z-e dg d��Z.d[dd�Z/G d d � d e0�Z1d d � Z2d d!� Z3d"d#� Z4d\d%d&�Z5d'd(� Z6d)d*� Z7d+d,� Z8G d-d.� d.e0�Z9G d/d0� d0e0�Z:G d1d2� d2e:�Z;G d3d4� d4e;�Z<G d5d6� d6e0�Z=G d7d8� d8e=�Z>G d9d:� d:e>�Z?G d;d<� d<e>�Z@G d=d>� d>e0�ZAG d?d@� d@eA�ZBG dAdB� dBeA�ZCG dCdD� dDeA�ZDG dEdF� dFeA�ZEG dGdH� dHeA�ZFG dIdJ� dJeA�ZGG dKdL� dLeA�ZHG dMdN� dNeA�ZIG dOdP� dPeA�ZJG dQdR� dRe0�ZKG dSdT� dTeA�ZLG dUdV� dVe0�ZMG dWdX� dXe=�ZNG dYdZ� dZeA�ZOdS )]� N)� namedtuple)�deepcopy)�sha1��parse)�tzlocal�tzutc)�UNSIGNED)� total_seconds)�compat_shell_split)�Config)�UnknownCredentialError)�PartialCredentialsError)�ConfigNotFound)�InvalidConfigError)�InfiniteLoopConfigError)� RefreshWithMFAUnsupportedError)�MetadataRetrievalError)�CredentialRetrievalError)�UnauthorizedSSOTokenError)�InstanceMetadataFetcher�parse_key_val_file)�ContainerMetadataFetcher)�FileWebIdentityTokenLoader)�SSOTokenLoader�ReadOnlyCredentials�� access_key� secret_key�tokenc s � � d�p d}� � d�}� � d�}� �� �d�du}� � d�� � d�d�}|du rVi }t� }t� } tt||� �� |d �d �} t� ||d �} t � fd d �t � |�||t || | g�| d�} || g} | j ||d�}t � t� | | g}| | | }|�r|�|� t�d� t|d�}|S )z�Create a default credential resolver. This creates a pre-configured credential resolver that includes the default lookup chain for credentials. �profile�defaultZmetadata_service_timeoutZ metadata_service_num_attemptsN� ec2_metadata_service_endpoint� imds_use_ipv6)r" r# )�timeout� num_attempts� user_agent�config)�iam_role_fetcher)�cache� region_namec s � j S �N)� full_config� ��sessionr- ��/root/rpmbuild/BUILDROOT/imh-python39-modules-3.9.7-92.el8.x86_64/opt/imh-python/lib/python3.9/site-packages/botocore/credentials.py�<lambda>Z � z,create_credential_resolver.<locals>.<lambda>)� load_config�client_creatorr) � profile_name�credential_sourcer�profile_provider_builder�r5 �disable_env_varszWSkipping environment variable credential check because profile name was explicitly set.�� providers)�get_config_variableZinstance_variables�get� EnvProvider�ContainerProvider�InstanceMetadataProviderr r& �ProfileProviderBuilder�AssumeRoleProvider�_get_client_creator� CanonicalNameCredentialSourcerr; �OriginalEC2Provider� BotoProvider�remove�logger�debug�CredentialResolver)r/ r) r* r5 Zmetadata_timeoutr% r9 Z imds_configZ env_providerZcontainer_providerZinstance_metadata_providerr7 �assume_role_providerZ pre_profile�profile_providersZ post_profiler; �resolverr- r. r0 �create_credential_resolver7 sh ����� �� ��� rN c @ sL e Zd ZdZddd�Zddd�Zdd � Zd d � Zd d � Zdd� Z dd� Z dS )rA a� This class handles the creation of profile based providers. NOTE: This class is only intended for internal use. This class handles the creation and ordering of the various credential providers that primarly source their configuration from the shared config. This is needed to enable sharing between the default credential chain and the source profile chain created by the assume role provider. Nc C s || _ || _|| _|| _d S r+ )�_session�_cache� _region_name�_sso_token_cache)�selfr/ r) r* Zsso_token_cacher- r- r0 �__init__� s z ProfileProviderBuilder.__init__Fc C s. | � ||�| �|�| �|�| �|�| �|�gS r+ )� _create_web_identity_provider�_create_sso_provider�"_create_shared_credential_provider�_create_process_provider�_create_config_provider�rS r5 r9 r- r- r0 r; � s ��z ProfileProviderBuilder.providersc s t |� fdd�d�S )Nc s � j jS r+ �rO r, r- �rS r- r0 r1 � r2 zAProfileProviderBuilder._create_process_provider.<locals>.<lambda>)r5 r3 )�ProcessProvider�rS r5 r- r\ r0 rX � s �z/ProfileProviderBuilder._create_process_providerc C s | j �d�}t||d�S )NZcredentials_file)r5 �creds_filename)rO r< �SharedCredentialProvider)rS r5 Zcredential_filer- r- r0 rW � s �z9ProfileProviderBuilder._create_shared_credential_providerc C s | j �d�}t||d�S )N� config_file)r5 �config_filename)rO r< �ConfigProvider)rS r5 ra r- r- r0 rY � s �z.ProfileProviderBuilder._create_config_providerc s& t � fdd�t� j� j�� j||d�S )Nc s � j jS r+ r[ r- r\ r- r0 r1 � r2 zFProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>)r3 r4 r) r5 r9 )�!AssumeRoleWithWebIdentityProviderrC rO rQ rP rZ r- r\ r0 rU � s ��z4ProfileProviderBuilder._create_web_identity_providerc s" t � fdd�� jj|� j� jd�S )Nc s � j jS r+ r[ r- r\ r- r0 r1 � r2 z=ProfileProviderBuilder._create_sso_provider.<locals>.<lambda>)r3 r4 r5 r) � token_cache)� SSOProviderrO � create_clientrP rR r^ r- r\ r0 rV � s �z+ProfileProviderBuilder._create_sso_provider)NNN)F) �__name__� __module__� __qualname__�__doc__rT r; rX rW rY rU rV r- r- r- r0 rA � s � rA c C s t | �}|�� S r+ )rN �load_credentials)r/ rM r- r- r0 �get_credentials� s rm c C s t j �t� �S r+ )�datetime�nowr r- r- r- r0 � _local_now� s rp c C s t | tj�r| S t| �S r+ )� isinstancern r )�valuer- r- r0 �_parse_if_needed� s rs Fc C s& t | tj�r"|r| �� S | �d�S | S )Nz%Y-%m-%dT%H:%M:%S%Z)rq rn � isoformat�strftime)rr �isor- r- r0 �_serialize_if_needed� s rw c s � �fdd�}|S )Nc s* d� i}|j f i |�� �j| fi |��S )Nr* )�updaterg )� service_name�kwargsZcreate_client_kwargs�r* r/ r- r0 r4 � s �z+_get_client_creator.<locals>.client_creatorr- )r/ r* r4 r- r{ r0 rC � s rC c s � �fdd�}|S )Nc s: � j f i ���} | d }|d |d |d t|d �d�S )N� Credentials� AccessKeyId�SecretAccessKey� SessionToken� Expiration�r r r � expiry_time)� assume_rolerw )�response� credentials��client�paramsr- r0 �refresh� s �z-create_assume_role_refresher.<locals>.refreshr- )r� r� r� r- r� r0 � create_assume_role_refresher� s r� c C s G dd� dt �}|| �S )Nc @ s e Zd Zdd� Zdd� ZdS )z/create_mfa_serial_refresher.<locals>._Refresherc S s || _ d| _d S )NF)�_refresh�_has_been_called)rS r� r- r- r0 rT s z8create_mfa_serial_refresher.<locals>._Refresher.__init__c S s | j r t� �d| _ | �� S �NT)r� r r� r\ r- r- r0 �__call__ s z8create_mfa_serial_refresher.<locals>._Refresher.__call__N)rh ri rj rT r� r- r- r- r0 � _Refresher s r� )�object)Zactual_refreshr� r- r- r0 �create_mfa_serial_refresher s r� c @ sV e Zd ZdZej�ej�dddd��Zefdd�Z dd � Z d d � Z d d � Z dd� Z dS )� JSONFileCachez�JSON file cache. This provides a dict like interface that stores JSON serializable objects. The objects are serialized to JSON and stored in a file. These values can be retrieved at a later time. �~�.awsZbotor) c C s || _ d S r+ )� _working_dir)rS Z working_dirr- r- r0 rT s zJSONFileCache.__init__c C s | � |�}tj�|�S r+ )�_convert_cache_key�os�path�isfile)rS � cache_key� actual_keyr- r- r0 � __contains__! s zJSONFileCache.__contains__c C sh | � |�}z8t|�� }t�|�W d � W S 1 s60 Y W n tttfyb t|��Y n0 dS )z Retrieve value from a cache key.N)r� �open�json�load�OSError� ValueError�IOError�KeyError)rS r� r� �fr- r- r0 � __getitem__% s .zJSONFileCache.__getitem__c C s� | � |�}ztj|td�}W n" ttfy> td| ��Y n0 tj�| j �sZt� | j � t� t� |tj tjB d�d��"}|�� |�|� W d � n1 s�0 Y d S )N)r! z5Value cannot be cached, must be JSON serializable: %si� �w)r� r� �dumpsrw � TypeErrorr� r� r� �isdirr� �makedirs�fdopenr� �O_WRONLY�O_CREAT�truncate�write)rS r� rr Zfull_keyZ file_contentr� r- r- r0 � __setitem__. s" � ��zJSONFileCache.__setitem__c C s t j�| j|d �}|S )Nz.json)r� r� �joinr� )rS r� � full_pathr- r- r0 r� < s z JSONFileCache._convert_cache_keyN)rh ri rj rk r� r� � expanduserr� Z CACHE_DIRrT r� r� r� r� r- r- r- r0 r� s r� c @ s* e Zd ZdZd dd�Zdd� Zdd� ZdS ) r| a\ Holds the credentials needed to authenticate requests. :ivar access_key: The access key part of the credentials. :ivar secret_key: The secret key part of the credentials. :ivar token: The security token, valid only for session credentials. :ivar method: A string which identifies where the credentials were found. Nc C s0 || _ || _|| _|d u r d}|| _| �� d S )N�explicit)r r r �method� _normalize)rS r r r r� r- r- r0 rT L s zCredentials.__init__c C s$ t j�| j�| _t j�| j�| _d S r+ )�botocore�compat�ensure_unicoder r r\ r- r- r0 r� X s zCredentials._normalizec C s t | j| j| j�S r+ )r r r r r\ r- r- r0 �get_frozen_credentialsb s �z"Credentials.get_frozen_credentials)NN)rh ri rj rk rT r� r� r- r- r- r0 r| A s � r| c @ s� e Zd ZdZdZdZefdd�Zdd� Ze dd � �Z e d d � �Z e j d d � �Z e d d� �Zej dd� �Ze dd� �Zej dd� �Zdd� Zd$dd�Zdd� Zdd� Zd d � Zed d � �Zd d!� Zd"d#� ZdS )%�RefreshableCredentialsa� Holds the credentials needed to authenticate requests. In addition, it knows how to refresh itself. :ivar access_key: The access key part of the credentials. :ivar secret_key: The secret key part of the credentials. :ivar token: The security token, valid only for session credentials. :ivar method: A string which identifies where the credentials were found. � iX c C sN || _ || _|| _|| _|| _|| _t�� | _|| _ t |||�| _ | � � d S r+ ) �_refresh_using� _access_key� _secret_key�_token� _expiry_time� _time_fetcher� threading�Lock� _refresh_lockr� r �_frozen_credentialsr� )rS r r r r� � refresh_usingr� � time_fetcherr- r- r0 rT z s �z RefreshableCredentials.__init__c C s$ t j�| j�| _t j�| j�| _d S r+ )r� r� r� r� r� r\ r- r- r0 r� � s z!RefreshableCredentials._normalizec C s. | |d |d |d | � |d �||d�}|S )Nr r r r� )r r r r� r� r� )�_expiry_datetime)�cls�metadatar� r� �instancer- r- r0 �create_from_metadata� s �z+RefreshableCredentials.create_from_metadatac C s | � � | jS �z�Warning: Using this property can lead to race conditions if you access another property subsequently along the refresh boundary. Please use get_frozen_credentials instead. )r� r� r\ r- r- r0 r � s z!RefreshableCredentials.access_keyc C s || _ d S r+ )r� �rS rr r- r- r0 r � s c C s | � � | jS r� )r� r� r\ r- r- r0 r � s z!RefreshableCredentials.secret_keyc C s || _ d S r+ )r� r� r- r- r0 r � s c C s | � � | jS r� )r� r� r\ r- r- r0 r � s z RefreshableCredentials.tokenc C s || _ d S r+ )r� r� r- r- r0 r � s c C s | j | �� }t|�S r+ )r� r� r )rS �deltar- r- r0 �_seconds_remaining� s z)RefreshableCredentials._seconds_remainingNc C s: | j du rdS |du r | j}| �� |kr,dS t�d� dS )a� Check if a refresh is needed. A refresh is needed if the expiry time associated with the temporary credentials is less than the provided ``refresh_in``. If ``time_delta`` is not provided, ``self.advisory_refresh_needed`` will be used. For example, if your temporary credentials expire in 10 minutes and the provided ``refresh_in`` is ``15 * 60``, then this function will return ``True``. :type refresh_in: int :param refresh_in: The number of seconds before the credentials expire in which refresh attempts should be made. :return: True if refresh needed, False otherwise. NFz!Credentials need to be refreshed.T)r� �_advisory_refresh_timeoutr� rH rI �rS � refresh_inr- r- r0 �refresh_needed� s z%RefreshableCredentials.refresh_neededc C s | j dd�S )Nr )r� )r� r\ r- r- r0 � _is_expired� s z"RefreshableCredentials._is_expiredc C s� | � | j�sd S | j�d�rpzD| � | j�s:W | j�� d S | � | j�}| j|d� W | j�� d S | j�� 0 nZ| � | j�r�| j�8 | � | j�s�W d � d S | jdd� W d � n1 s�0 Y d S )NF)� is_mandatoryT)r� r� r� �acquire�release�_mandatory_refresh_timeout�_protected_refresh)rS Zis_mandatory_refreshr- r- r0 r� � s* �� � z RefreshableCredentials._refreshc C s� z | � � }W nH tyT } z0|r$dnd}tjd|dd� |r>� W Y d }~d S d }~0 0 | �|� t| j| j| j�| _ | � � r�d}t�|� t |��d S )N� mandatoryZadvisoryzARefreshing temporary credentials failed during %s refresh period.T��exc_infozLCredentials were refreshed, but the refreshed credentials are still expired.) r� � ExceptionrH �warning�_set_from_datar r� r� r� r� r� � RuntimeError)rS r� r� �eZ period_name�msgr- r- r0 r� s$ � � z)RefreshableCredentials._protected_refreshc C s t | �S r+ r )Ztime_strr- r- r0 r� ( s z'RefreshableCredentials._expiry_datetimec s� g d�}� s|}n� fdd�|D �}|rDd}t | j|d�|� d��� d | _� d | _� d | _t� d �| _t� d | j� | � � d S ) Nr� c s g | ]}|� vr|�qS r- r- )�.0�k��datar- r0 � <listcomp>1 r2 z9RefreshableCredentials._set_from_data.<locals>.<listcomp>z7Credential refresh failed, response did not contain: %s�, ��provider� error_msgr r r r� z(Retrieved credentials will expire at: %s) r r� r� r r r r r� rH rI r� )rS r� Z expected_keysZ missing_keys�messager- r� r0 r� , s$ � �z%RefreshableCredentials._set_from_datac C s | � � | jS )a� Return immutable credentials. The ``access_key``, ``secret_key``, and ``token`` properties on this class will always check and refresh credentials if needed before returning the particular credentials. This has an edge case where you can get inconsistent credentials. Imagine this: # Current creds are "t1" tmp.access_key ---> expired? no, so return t1.access_key # ---- time is now expired, creds need refreshing to "t2" ---- tmp.secret_key ---> expired? yes, refresh and return t2.secret_key This means we're using the access key from t1 with the secret key from t2. To fix this issue, you can request a frozen credential object which is guaranteed not to change. The frozen credentials returned from this method should be used immediately and then discarded. The typical usage pattern would be:: creds = RefreshableCredentials(...) some_code = SomeSignerObject() # I'm about to sign the request. # The frozen credentials are only used for the # duration of generate_presigned_url and will be # immediately thrown away. request = some_code.sign_some_request( with_credentials=creds.get_frozen_credentials()) print("Signed request:", request) )r� r� r\ r- r- r0 r� B s "z-RefreshableCredentials.get_frozen_credentials)N)rh ri rj rk r� r� rp rT r� � classmethodr� �propertyr �setterr r r� r� r� r� r� � staticmethodr� r� r� r- r- r- r0 r� h s: � " ! r� c s. e Zd ZdZefdd�Zd� fdd� Z� ZS )� DeferredRefreshableCredentialszyRefreshable credentials that don't require initial credentials. refresh_using will be called upon first access. c C s> || _ d | _d | _d | _d | _|| _t�� | _|| _ d | _ d S r+ ) r� r� r� r� r� r� r� r� r� r� r� )rS r� r� r� r- r- r0 rT m s z'DeferredRefreshableCredentials.__init__Nc s | j d u rdS tt| ��|�S r� )r� �superr� r� r� �� __class__r- r0 r� x s �z-DeferredRefreshableCredentials.refresh_needed)N)rh ri rj rk rp rT r� � __classcell__r- r- r� r0 r� h s r� c @ sZ e Zd ZdZddd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dS )�CachedCredentialFetcherr� Nc C s4 |d u r i }|| _ | �� | _|d u r*| j}|| _d S r+ )rP �_create_cache_key� _cache_key� DEFAULT_EXPIRY_WINDOW_SECONDS�_expiry_window_seconds)rS r) �expiry_window_secondsr- r- r0 rT � s z CachedCredentialFetcher.__init__c C s t d��d S )Nz_create_cache_key()��NotImplementedErrorr\ r- r- r0 r� � s z)CachedCredentialFetcher._create_cache_keyc C s$ |� dd�� tjjd�}|� dd�S )N�:�_�/)�replacer� r� �sep)rS �filenamer- r- r0 �_make_file_safe� s z'CachedCredentialFetcher._make_file_safec C s t d��d S )Nz_get_credentials()r� r\ r- r- r0 �_get_credentials� s z(CachedCredentialFetcher._get_credentialsc C s | � � S r+ )�_get_cached_credentialsr\ r- r- r0 �fetch_credentials� s z)CachedCredentialFetcher.fetch_credentialsc C s` | � � }|du r$| �� }| �|� n t�d� |d }t|d dd�}|d |d |d |d �S ) z�Get up-to-date credentials. This will check the cache for up-to-date credentials, calling assume role if none are available. Nz*Credentials for role retrieved from cache.r| r� T)rv r} r~ r r� )�_load_from_cacher �_write_to_cacherH rI rw )rS r� �creds� expirationr- r- r0 r � s �z/CachedCredentialFetcher._get_cached_credentialsc C s8 | j | jv r4t| j| j �}| �|�s*|S t�d� d S )Nz6Credentials were found in cache, but they are expired.)r� rP r r� rH rI )rS r r- r- r0 r � s �z(CachedCredentialFetcher._load_from_cachec C s t |�| j| j< d S r+ )r rP r� )rS r� r- r- r0 r � s z'CachedCredentialFetcher._write_to_cachec C s( t |d d �}t|t� �}|| jk S )z!Check if credentials are expired.r| r� )rs r rp r� )rS r� Zend_time�secondsr- r- r0 r� � s z#CachedCredentialFetcher._is_expired)NN) rh ri rj r� rT r� r r r r r r r� r- r- r- r0 r� � s r� c s. e Zd Zd� fdd� Zdd� Zdd� Z� ZS ) � BaseAssumeRoleCredentialFetcherNc sj || _ || _|d u r i | _n t|�| _| j| jd< | j�d�| _d| _| jsT| �� tt | �� ||� d S )NZRoleArn�RoleSessionNameF) �_client_creatorZ _role_arn�_assume_kwargsr r= �_role_session_name�_using_default_session_name�_generate_assume_role_namer� r rT )rS r4 �role_arn� extra_argsr) r� r� r- r0 rT � s �z(BaseAssumeRoleCredentialFetcher.__init__c C s( dt t�� � | _| j| jd< d| _d S )Nzbotocore-session-%sr T)�int�timer r r r\ r- r- r0 r � s z:BaseAssumeRoleCredentialFetcher._generate_assume_role_namec C sZ t | j�}| jr|d= d|v r0t�|d �|d< tj|dd�}t|�d���� }| � |�S )��Create a predictable cache key for the current configuration. The cache key is intended to be compatible with file names. r �PolicyT)� sort_keys�utf-8) r r r r� �loadsr� r �encode� hexdigestr �rS �argsZ argument_hashr- r- r0 r� � s z1BaseAssumeRoleCredentialFetcher._create_cache_key)NNN)rh ri rj rT r r� r� r- r- r� r0 r � s �r c s6 e Zd Zd � fdd� Zdd� Zdd� Zdd � Z� ZS ) �AssumeRoleCredentialFetcherNc s< || _ || _| jdu r tj| _tt| �j|||||d� dS )a� :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type source_credentials: Credentials :param source_credentials: The credentials to use to create the client for the call to AssumeRole. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type mfa_prompter: callable :param mfa_prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, N�r r) r� )�_source_credentials� _mfa_prompter�getpassr� r# rT )rS r4 �source_credentialsr r � mfa_prompterr) r� r� r- r0 rT � s " �z$AssumeRoleCredentialFetcher.__init__c C s | � � }| �� }|jf i |��S )�'Get credentials by calling assume role.)�_assume_role_kwargs�_create_clientr� )rS rz r� r- r- r0 r # s z,AssumeRoleCredentialFetcher._get_credentialsc C sT t | j�}|�d�}|dur6d| }| �|�}||d< |�d�}|durP||d< |S )�AGet the arguments for assume role based on current configuration.� SerialNumberNzEnter MFA code for %s: Z TokenCode�DurationSeconds)r r r= r& )rS �assume_role_kwargs� mfa_serial�promptZ token_code�duration_secondsr- r- r0 r+ ) s z/AssumeRoleCredentialFetcher._assume_role_kwargsc C s" | j �� }| jd|j|j|jd�S )z2Create an STS client using the source credentials.�sts)�aws_access_key_id�aws_secret_access_key�aws_session_token)r% r� r r r r )rS Zfrozen_credentialsr- r- r0 r, ; s �z*AssumeRoleCredentialFetcher._create_client)NNNN)rh ri rj rT r r+ r, r� r- r- r� r0 r# � s �,r# c s. e Zd Zd� fdd� Zdd� Zdd� Z� ZS ) �*AssumeRoleWithWebIdentityCredentialFetcherNc s$ || _ tt| �j|||||d� dS )aG :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type web_identity_token_loader: callable :param web_identity_token_loader: A callable that takes no arguments and returns a web identity token str. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, r$ N)�_web_identity_token_loaderr� r8 rT )rS r4 �web_identity_token_loaderr r r) r� r� r- r0 rT I s �z3AssumeRoleWithWebIdentityCredentialFetcher.__init__c C s0 | � � }ttd�}| jd|d�}|jf i |��S )r* )�signature_versionr4 �r' )r+ r r r Z assume_role_with_web_identity)rS rz r' r� r- r- r0 r m s z;AssumeRoleWithWebIdentityCredentialFetcher._get_credentialsc C s t | j�}| �� }||d< |S )r- ZWebIdentityToken)r r r9 )rS r0 Zidentity_tokenr- r- r0 r+ v s z>AssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargs)NNN)rh ri rj rT r r+ r� r- r- r� r0 r8 F s �$ r8 c @ s. e Zd ZdZdZddd�Zdd� Zdd� ZdS ) �CredentialProviderNc C s || _ d S r+ r. )rS r/ r- r- r0 rT � s zCredentialProvider.__init__c C s dS )a~ Loads the credentials from their source & sets them on the object. Subclasses should implement this method (by reading from disk, the environment, the network or wherever), returning ``True`` if they were found & loaded. If not found, this method should return ``False``, indictating that the ``CredentialResolver`` should fall back to the next available method. The default implementation does nothing, assuming the user has set the ``access_key/secret_key/token`` themselves. :returns: Whether credentials were found & set :rtype: Credentials Tr- r\ r- r- r0 r� � s zCredentialProvider.loadc G sF g }|D ]8}z|� || � W q ty> t| j|d��Y q0 q|S )N�r� Zcred_var)�appendr� r �METHOD)rS �mappingZ key_names�foundZkey_namer- r- r0 �_extract_creds_from_mapping� s �z.CredentialProvider._extract_creds_from_mapping)N)rh ri rj r@ �CANONICAL_NAMErT r� rC r- r- r- r0 r= s r= c @ s: e Zd ZdZejfdd�Zdd� Zdd� Ze dd � �Z d S ) r] zcustom-processc C s || _ || _d | _|| _d S r+ )� _profile_name� _load_config�_loaded_config�_popen)rS r5 r3 �popenr- r- r0 rT � s zProcessProvider.__init__c sd �j � � d u rd S ��� �}|�d�d urDt�|� �fdd��j�S t|d |d |�d��jd�S )Nr� c s �� � �S r+ )�_retrieve_credentials_usingr- ��credential_processrS r- r0 r1 � r2 z&ProcessProvider.load.<locals>.<lambda>r r r )r r r r� )�_credential_processrJ r= r� r� r@ r| )rS Z creds_dictr- rK r0 r� � s ��zProcessProvider.loadc C s� t |�}| j|tjtjd�}|�� \}}|jdkrFt| j|�d�d��t j j � |�d��}|� dd�}|dkr�t| jd| d��z$|d |d |� d �|� d �d �W S ty� } z t| jd| d��W Y d }~n d }~0 0 d S )N)�stdout�stderrr r r� �Versionz<Version key not provided>� zOUnsupported version '%s' for credential process provider, supported versions: 1r} r~ r r� r� z$Missing required key in response: %s)r rH � subprocess�PIPE� communicate� returncoder r@ �decoder� r� r� r r= r� ) rS rL Z process_list�prN rO �parsed�versionr� r- r- r0 rJ � s< � � ����z+ProcessProvider._retrieve_credentials_usingc C s6 | j d u r| �� | _ | j �di ��| ji �}|�d�S )N�profilesrL )rG rF r= rE )rS �profile_configr- r- r0 rM � s ��z#ProcessProvider._credential_processN) rh ri rj r@ rR �PopenrT r� rJ r� rM r- r- r- r0 r] � s r] c @ s$ e Zd ZdZdZdd� Zdd� ZdS )r@ ziam-roleZEc2InstanceMetadatac C s || _ d S r+ )� _role_fetcher)rS r( r- r- r0 rT � s z!InstanceMetadataProvider.__init__c C s> | j }|�� }|sd S t�d|d � tj|| j|jd�}|S )Nz#Found credentials from IAM Role: %s� role_name�r� r� )r] Z retrieve_iam_role_credentialsrH rI r� r� r@ )rS �fetcherr� r r- r- r0 r� � s ��z InstanceMetadataProvider.loadN)rh ri rj r@ rD rT r� r- r- r- r0 r@ � s r@ c @ sJ e Zd ZdZdZdZdZddgZdZdd d �Z d d � Z d d� Z dd� Z dS )r> �env� EnvironmentZAWS_ACCESS_KEY_IDZAWS_SECRET_ACCESS_KEYZAWS_SECURITY_TOKENZAWS_SESSION_TOKENZAWS_CREDENTIAL_EXPIRATIONNc C s$ |du rt j}|| _| �|�| _dS )a� :param environ: The environment variables (defaults to ``os.environ`` if no value is provided). :param mapping: An optional mapping of variable names to environment variable names. Use this if you want to change the mapping of access_key->AWS_ACCESS_KEY_ID, etc. The dict can have up to 3 keys: ``access_key``, ``secret_key``, ``session_token``. N)r� �environ�_build_mapping�_mapping)rS rc rA r- r- r0 rT s zEnvProvider.__init__c C s� i }|d u r6| j |d< | j|d< | j|d< | j|d< nd|�d| j �|d< |�d| j�|d< |�d| j�|d< t|d t�s�|d g|d< |�d| j�|d< |S )Nr r r r� )� ACCESS_KEY� SECRET_KEY�TOKENS� EXPIRY_TIMEr= rq �list)rS rA Z var_mappingr- r- r0 rd ( s* ����zEnvProvider._build_mappingc C s� | j �| jd d�}|r�t�d� | �� }|dd�}|d }|durnt|�}t|d |d |d ||| jd �S t |d |d |d | jd �S dS dS ) zK Search for credentials in explicit environment variables. r � z+Found credentials in environment variables.F)�require_expiryr� Nr r )r� r� �r� ) rc r= re rH �info�_create_credentials_fetcherr r� r@ r| )rS r r` r� r� r- r- r0 r� > s$ � �zEnvProvider.loadc s( | j �| j�| j� d� ��fdd� }|S )NTc s� i }� � �d d�}|s(t��d d��||d< � � �d d�}|sTt��d d��||d< d |d< �d D ] }� � |d�}|rl||d< q�qld |d< � � �d d�}|r�||d< | r�|s�t��d d��|S )Nr rk r> r r r� )r= r )rl r� r r Z token_env_varr r� �rc rA r� r- r0 r _ s8 �� �zBEnvProvider._create_credentials_fetcher.<locals>.fetch_credentials)T)re r@ rc )rS r r- rp r0 ro Z s z'EnvProvider._create_credentials_fetcher)NN) rh ri rj r@ rD rf rg rh ri rT rd r� ro r- r- r- r0 r> s r> c @ s2 e Zd ZdZdZdZdZdZd dd�Zd d � Z dS ) rE zec2-credentials-fileZ Ec2Config�AWS_CREDENTIAL_FILEZAWSAccessKeyIdZ AWSSecretKeyNc C s* |d u rt j}|d u rt}|| _|| _d S r+ )r� rc r �_environ�_parser)rS rc �parserr- r- r0 rT � s z OriginalEC2Provider.__init__c C sh d| j v r`tj�| j d �}| �|�}| j|v rdt�d� || j }|| j }t ||| j d�S ndS dS )zN Search for a credential file used by original EC2 CLI tools. rq z)Found credentials in AWS_CREDENTIAL_FILE.rm N) rr r� r� r� rs rf rH rn rg r| r@ )rS r� r r r r- r- r0 r� � s � zOriginalEC2Provider.load)NN) rh ri rj r@ rD Z CRED_FILE_ENVrf rg rT r� r- r- r- r0 rE � s rE c @ s> e Zd ZdZdZdZdZddgZddd �Zd d � Z d d � Z dS )r` zshared-credentials-fileZSharedCredentialsr5 r6 �aws_security_tokenr7 Nc C s2 || _ |d u rd}|| _|d u r(tjj}|| _d S )Nr! )�_creds_filenamerE r� � configloader�raw_config_parse� _ini_parser)rS r_ r5 � ini_parserr- r- r0 rT � s z!SharedCredentialProvider.__init__c C s� z| � | j�}W n ty$ Y d S 0 | j|v r�|| j }| j|v r�t�d| j� | �|| j| j�\}}| � |�}t |||| j d�S d S )Nz0Found credentials in shared credentials file: %srm ) ry rv r rE rf rH rn rC rg �_get_session_tokenr| r@ )rS Zavailable_credsr' r r r r- r- r0 r� � s" � � �z SharedCredentialProvider.loadc C s$ | j D ]}||v r|| S qd S r+ �rh )rS r' Z token_envvarr- r- r0 r{ � s z+SharedCredentialProvider._get_session_token)NN) rh ri rj r@ rD rf rg rh rT r� r{ r- r- r- r0 r` � s r` c @ sB e Zd ZdZdZdZdZdZddgZdd d �Z d d � Z d d� Z dS )rc z0INI based config provider with profile sections.z config-fileZ SharedConfigr5 r6 ru r7 Nc C s& || _ || _|du r tjj}|| _dS )a :param config_filename: The session configuration scoped to the current profile. This is available via ``session.config``. :param profile_name: The name of the current profile. :param config_parser: A config parser callable. N)�_config_filenamerE r� rw r3 �_config_parser)rS rb r5 Z config_parserr- r- r0 rT � s zConfigProvider.__init__c C s� z| � | j�}W n ty$ Y dS 0 | j|d v r�|d | j }| j|v r�t�d| j� | �|| j| j�\}}| � |�}t |||| j d�S ndS dS )zr If there is are credentials in the configuration associated with the session, use those. NrZ z$Credentials found in config file: %srm ) r~ r} r rE rf rH rn rC rg r{ r| r@ )rS r, r[ r r r r- r- r0 r� � s$ � � �zConfigProvider.loadc C s$ | j D ]}||v r|| S qd S r+ r| )rS r[ Z token_namer- r- r0 r{ � s z!ConfigProvider._get_session_token)N) rh ri rj rk r@ rD rf rg rh rT r� r{ r- r- r- r0 rc � s rc c @ s: e Zd ZdZdZdZddgZdZdZd d d �Z d d � Z dS )rF z boto-configZ Boto2ConfigZ BOTO_CONFIGz /etc/boto.cfgz~/.botor5 r6 Nc C s. |d u rt j}|d u r tjj}|| _|| _d S r+ )r� rc r� rw rx rr ry )rS rc rz r- r- r0 rT s zBotoProvider.__init__c C s� | j | jv r | j| j g}n| j}|D ]z}z| �|�}W n tyN Y q&Y n0 d|v r&|d }| j|v r&t�d|� | �|| j| j �\}}t ||| j d� S q&dS )z; Look for credentials in boto config file. r| z)Found credentials in boto config file: %srm N) �BOTO_CONFIG_ENVrr �DEFAULT_CONFIG_FILENAMESry r rf rH rn rC rg r| r@ )rS Zpotential_locationsr r' r� r r r- r- r0 r� s( � ��zBotoProvider.load)NN) rh ri rj r@ rD r r� rf rg rT r� r- r- r- r0 rF s rF c @ s� e Zd ZdZdZdZdZdZejddfdd�Z dd � Z d d � Z d d � Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � ZdS ) rB � assume-roleNr �web_identity_token_filer� c C s> || _ || _|| _|| _|| _i | _|| _|| _| jg| _dS )a� :type load_config: callable :param load_config: A function that accepts no arguments, and when called, will return the full configuration dictionary for the session (``session.full_config``). :type client_creator: callable :param client_creator: A factory function that will create a client when called. Has the same interface as ``botocore.session.Session.create_client``. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in the CLI. :type profile_name: str :param profile_name: The name of the profile. :type prompter: callable :param prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type credential_sourcer: CanonicalNameCredentialSourcer :param credential_sourcer: A credential provider that takes a configuration, which is used to provide the source credentials for the STS call. N) r) rF r rE � _prompterrG �_credential_sourcer�_profile_provider_builder�_visited_profiles)rS r3 r4 r) r5 Zprompterr6 r7 r- r- r0 rT > s $zAssumeRoleProvider.__init__c C s@ | � � | _| j�di �}|�| ji �}| �|�r<| �| j�S d S �NrZ )rF rG r= rE � _has_assume_role_config_vars�_load_creds_via_assume_role)rS rZ r r- r- r0 r� u s zAssumeRoleProvider.loadc C s | j |v o| j|vS r+ )�ROLE_CONFIG_VAR�WEB_IDENTITY_TOKE_FILE_VAR�rS r r- r- r0 r� | s �z/AssumeRoleProvider._has_assume_role_config_varsc C s� | � |�}| �||�}i }|�d�}|d ur4||d< |�d�}|d urN||d< |�d�}|d urh||d< |�d�}|d ur�||d< t| j||d || j| jd �} | j} |d ur�t| �} t | j | t d �S ) N�role_session_namer � external_idZ ExternalIdr1 r. r3 r/ r )r4 r( r r r) r) )r� r� r� ) �_get_role_config�_resolve_source_credentialsr= r# r r� r) r r� r� r@ rp ) rS r5 � role_configr( r r� r� r1 r3 r` Z refresherr- r- r0 r� � sB � ��z.AssumeRoleProvider._load_creds_via_assume_rolec C s� | j �di �}|| }|�d�}|d }|�d�}|�d�}|�d�}|�d�} |�d�} |||| ||d �} | d ur�zt| �| d< W n ty� Y n0 |d ur�|d ur�td | d ��nB|d u r�|d u r�t| jd d��n"|d ur�| �||� n | �||� | S )z?Retrieves and validates the role configuration for the profile.rZ �source_profiler �credential_sourcer1 r� r� r3 )r r� r1 r� r� r� NzDThe profile "%s" contains both source_profile and credential_source.�r� z#source_profile or credential_sourcer> ) rG r= r r� r r r@ �_validate_credential_source�_validate_source_profile) rS r5 rZ r r� r r� r1 r� r� r3 r� r- r- r0 r� � sL � ���� z#AssumeRoleProvider._get_role_configc C s> | j d u r td||f d��| j �|�s:td||f d��d S )Nz_The credential_source "%s" is specified in profile "%s", but no source provider was configured.r� zCThe credential source "%s" referenced in profile "%s" is not valid.)r� r � is_supported)rS Zparent_profiler� r- r- r0 r� � s ��� ��z.AssumeRoleProvider._validate_credential_sourcec C s t | �|�| �|�g�S r+ )�any�_has_static_credentialsr� r� r- r- r0 � _source_profile_has_credentials� s �z2AssumeRoleProvider._source_profile_has_credentialsc C sp | j �di �}||vr(td||f d��|| }|| jvr>d S ||krTt|| jd��| �|�slt|| jd��d S )NrZ zFThe source_profile "%s" referenced in the profile "%s" does not exist.r� )r� Zvisited_profiles)rG r= r r� r r� )rS Zparent_profile_nameZsource_profile_namerZ r� r- r- r0 r� � s* ��� � �z+AssumeRoleProvider._validate_source_profilec s ddg}t � fdd�|D ��S )Nr6 r5 c 3 s | ]}|� v V qd S r+ r- )r� Z static_key�r r- r0 � <genexpr> r2 z=AssumeRoleProvider._has_static_credentials.<locals>.<genexpr>)r� )rS r Z static_keysr- r� r0 r� s z*AssumeRoleProvider._has_static_credentialsc C s< |� d�}|d ur | �||�S |d }| j�|� | �|�S )Nr� r� )r= � _resolve_credentials_from_sourcer� r? �!_resolve_credentials_from_profile)rS r� r5 r� r� r- r- r0 r� ! s � z.AssumeRoleProvider._resolve_source_credentialsc C s� | j �di �}|| }| �|�r0| js0| �|�S | �|�sD| �|�s�| jj|dd�}t|�}|�� }|d u r~d}t || d��|S | � |�S )NrZ Tr8 z.The source profile "%s" must have credentials.r� ) rG r= r� r� �(_resolve_static_credentials_from_profiler� r; rJ rl r r� )rS r5 rZ r rL Z profile_chainr� � error_messager- r- r0 r� , s. � ����z4AssumeRoleProvider._resolve_credentials_from_profilec C sZ z t |d |d |�d�d�W S tyT } z t| jt|�d��W Y d }~n d }~0 0 d S )Nr5 r6 r7 r r> )r| r= r� r r@ �str)rS r r� r- r- r0 r� J s � �z;AssumeRoleProvider._resolve_static_credentials_from_profilec C s( | j �|�}|d u r$t|d| d��|S )NzBNo credentials found in credential_source referenced in profile %sr� )r� r( r )rS r� r5 r� r- r- r0 r� U s ���z3AssumeRoleProvider._resolve_credentials_from_source)rh ri rj r@ rD r� r� ZEXPIRY_WINDOW_SECONDSr' rT r� r� r� r� r� r� r� r� r� r� r� r� r- r- r- r0 rB / s( � 7 ,2 & rB c @ sR e Zd ZdZdZdddd�Zddd �Zd d � Zd d � Zdd� Z dd� Z dd� Z dS )rd z assume-role-with-web-identityNZAWS_WEB_IDENTITY_TOKEN_FILEZAWS_ROLE_SESSION_NAMEZ AWS_ROLE_ARN)r� r� r Fc C s: || _ || _|| _|| _d | _|| _|d u r0t}|| _d S r+ )r) rF r rE �_profile_config�_disable_env_varsr �_token_loader_cls)rS r3 r4 r5 r) r9 Ztoken_loader_clsr- r- r0 rT m s z*AssumeRoleWithWebIdentityProvider.__init__c C s | � � S r+ )� _assume_role_with_web_identityr\ r- r- r0 r� � s z&AssumeRoleWithWebIdentityProvider.loadc C s: | j d u r.| �� }|�di �}|�| ji �| _ | j �|�S r� )r� rF r= rE )rS �key� loaded_configrZ r- r- r0 �_get_profile_config� s z5AssumeRoleWithWebIdentityProvider._get_profile_configc C s2 | j r d S | j�|�}|r.|tjv r.tj| S d S r+ )r� �_CONFIG_TO_ENV_VARr= r� rc )rS r� Zenv_keyr- r- r0 �_get_env_config� s z1AssumeRoleWithWebIdentityProvider._get_env_configc C s | � |�}|d ur|S | �|�S r+ )r� r� )rS r� Z env_valuer- r- r0 � _get_config� s z-AssumeRoleWithWebIdentityProvider._get_configc C s| | � d�}|sd S | �|�}| � d�}|s8d}t|d��i }| � d�}|d urV||d< t| j|||| jd�}t| j|jd�S ) Nr� r z�The provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r� r� r )r4 r: r r r) r_ ) r� r� r r8 r r) r� r@ r )rS Z token_path� token_loaderr r� r r� r` r- r- r0 r� � s0 � � �z@AssumeRoleWithWebIdentityProvider._assume_role_with_web_identity)NFN) rh ri rj r@ rD r� rT r� r� r� r� r� r- r- r- r0 rd d s � � rd c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd S )rD c C s || _ d S r+ �� _providers�rS r; r- r- r0 rT � s z'CanonicalNameCredentialSourcer.__init__c C s |dd� | j D �v S )aL Validates a given source name. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: bool :returns: True if the credential provider is supported, False otherwise. c S s g | ] }|j �qS r- )rD �r� rW r- r- r0 r� � r2 z?CanonicalNameCredentialSourcer.is_supported.<locals>.<listcomp>r� )rS � source_namer- r- r0 r� � s z+CanonicalNameCredentialSourcer.is_supportedc C s$ | � |�}t|t�r |�� S |�� S )a Loads source credentials based on the provided configuration. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: Credentials )� _get_providerrq rJ rl r� )rS r� �sourcer- r- r0 r( � s z1CanonicalNameCredentialSourcer.source_credentialsc C sV | � |�}|�� dv r@| �d�}|dur@|du r4|S t||g�S |du rRt|d��|S )a# Return a credential provider by its canonical name. :type canonical_name: str :param canonical_name: The canonical name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. )Z sharedconfigZsharedcredentialsr� N��name)� _get_provider_by_canonical_name�lower�_get_provider_by_methodrJ r )rS �canonical_namer� rK r- r- r0 r� � s z,CanonicalNameCredentialSourcer._get_providerc C s2 | j D ]&}|j}|r|�� |�� kr| S qdS )z�Return a credential provider by its canonical name. This function is strict, it does not attempt to address compatibility issues. N)r� rD r� )rS r� r� r� r- r- r0 r� s z>CanonicalNameCredentialSourcer._get_provider_by_canonical_namec C s" | j D ]}|j|kr| S qdS )z0Return a credential provider by its METHOD name.N)r� r@ )rS r� r� r- r- r0 r� s z6CanonicalNameCredentialSourcer._get_provider_by_methodN) rh ri rj rT r� r( r� r� r� r- r- r- r0 rD � s & rD c @ sR e Zd ZdZdZdZdZdZddd�Zd d � Z d d � Z d d� Z dd� Z dd� Z dS )r? zcontainer-roleZ EcsContainerZ&AWS_CONTAINER_CREDENTIALS_RELATIVE_URIZ"AWS_CONTAINER_CREDENTIALS_FULL_URIZ!AWS_CONTAINER_AUTHORIZATION_TOKENNc C s, |d u rt j}|d u r t� }|| _|| _d S r+ )r� rc r rr �_fetcher)rS rc r` r- r- r0 rT s zContainerProvider.__init__c C s$ | j | jv s| j| jv r | �� S d S r+ )�ENV_VARrr � ENV_VAR_FULL�_retrieve_or_failr\ r- r- r0 r� $ s zContainerProvider.loadc C sn | � � r | j�| j| j �}n | j| j }| �� }| �||�}|� }t|d |d |d | j t |d �|d�S )Nr r r r� )r r r r� r� r� ) �_provided_relative_urir� �full_urlrr r� r� �_build_headers�_create_fetcherr� r@ rs )rS �full_uri�headersr` r r- r- r0 r� * s �z#ContainerProvider._retrieve_or_failc C s& i }| j �| j�}|d ur"d|iS d S )N� Authorization)rr r= �ENV_VAR_AUTH_TOKEN)rS r� Z auth_tokenr- r- r0 r� ; s �z ContainerProvider._build_headersc s � ��fdd�}|S )Nc sz z�j j� �d�} W nF tyZ } z.tjd|dd� t�jt|�d��W Y d }~n d }~0 0 | d | d | d | d d �S ) N)r� z'Error retrieving container metadata: %sTr� r� r} r~ �Tokenr� r� )r� Zretrieve_full_urir rH rI r r@ r� )r� r� �r� r� rS r- r0 � fetch_credsD s � �� �z6ContainerProvider._create_fetcher.<locals>.fetch_credsr- )rS r� r� r� r- r� r0 r� C s z!ContainerProvider._create_fetcherc C s | j | jv S r+ )r� rr r\ r- r- r0 r� V s z(ContainerProvider._provided_relative_uri)NN)rh ri rj r@ rD r� r� r� rT r� r� r� r� r� r- r- r- r0 r? s r? c @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dS )rJ c C s || _ dS )zQ :param providers: A list of ``CredentialProvider`` instances. Nr: r� r- r- r0 rT [ s zCredentialResolver.__init__c C sJ zdd� | j D ��|�}W n ty6 t|d��Y n0 | j �||� dS )a= Inserts a new instance of ``CredentialProvider`` into the chain that will be tried before an existing one. :param name: The short name of the credentials you'd like to insert the new credentials before. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` c S s g | ] }|j �qS r- �r@ r� r- r- r0 r� r r2 z4CredentialResolver.insert_before.<locals>.<listcomp>r� N)r; �indexr� r �insert�rS r� Zcredential_provider�offsetr- r- r0 � insert_beforec s z CredentialResolver.insert_beforec C s | � |�}| j�|d |� dS )a9 Inserts a new type of ``Credentials`` instance into the chain that will be tried after an existing one. :param name: The short name of the credentials you'd like to insert the new credentials after. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` rQ N)�_get_provider_offsetr; r� r� r- r- r0 � insert_afterw s z CredentialResolver.insert_afterc C s6 dd� | j D �}||vr dS |�|�}| j �|� dS )z� Removes a given ``Credentials`` instance from the chain. :param name: The short name of the credentials instance to remove. :type name: string c S s g | ] }|j �qS r- r� r� r- r- r0 r� � r2 z-CredentialResolver.remove.<locals>.<listcomp>N)r; r� �pop)rS r� Zavailable_methodsr� r- r- r0 rG � s zCredentialResolver.removec C s | j | �|� S )z�Return a credential provider by name. :type name: str :param name: The name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. )r; r� �rS r� r- r- r0 � get_provider� s z CredentialResolver.get_providerc C s: zdd� | j D ��|�W S ty4 t|d��Y n0 d S )Nc S s g | ] }|j �qS r- r� r� r- r- r0 r� � r2 z;CredentialResolver._get_provider_offset.<locals>.<listcomp>r� )r; r� r� r r� r- r- r0 r� � s z'CredentialResolver._get_provider_offsetc C s6 | j D ]*}t�d|j� |�� }|dur| S qdS )zw Goes through the credentials chain, returning the first ``Credentials`` that could be loaded. z Looking for credentials via: %sN)r; rH rI r@ r� )rS r� r r- r- r0 rl � s z#CredentialResolver.load_credentialsN) rh ri rj rT r� r� rG r� r� rl r- r- r- r0 rJ Z s rJ c s: e Zd ZdZd � fdd� Zdd� Zdd� Zd d � Z� ZS ) �SSOCredentialFetcherz%Y-%m-%dT%H:%M:%SZNc s: || _ || _|| _|| _|| _|| _tt| ��||� d S r+ ) r � _sso_region� _role_name� _account_id� _start_url� _token_loaderr� r� rT ) rS Z start_url� sso_regionr^ Z account_idr4 r� r) r� r� r- r0 rT � s �z SSOCredentialFetcher.__init__c C s> | j | j| jd�}tj|ddd�}t|�d���� }| �|�S )r )ZstartUrl�roleName� accountIdT)�,r )r � separatorsr ) r� r� r� r� r� r r r r r! r- r- r0 r� � s � z&SSOCredentialFetcher._create_cache_keyc C s$ |d }t j �|t� �}|�| j�S )Ng @�@)rn � fromtimestampr ru �_UTC_DATE_FORMAT)rS Z timestamp_msZtimestamp_seconds� timestampr- r- r0 �_parse_timestamp� s z%SSOCredentialFetcher._parse_timestampc C s� t t| jd�}| jd|d�}| j| j| �| j�d�}z|jf i |��}W n |j j yd t � �Y n0 |d }d|d |d |d | � |d �d �d �}|S ) z4Get credentials by calling SSO get role credentials.)r; r* �ssor< )r� r� Z accessTokenZroleCredentialsZ accessKeyIdZsecretAccessKeyZ sessionTokenr )r} r~ r r� )Z ProviderTyper| ) r r r� r r� r� r� r� Zget_role_credentials� exceptionsZUnauthorizedExceptionr r� )rS r' r� rz r� r� r- r- r0 r � s, � � �� z%SSOCredentialFetcher._get_credentials)NNN) rh ri rj r� rT r� r� r r� r- r- r� r0 r� � s � r� c @ sL e Zd ZdZej�ej�dddd��Zg d�Z d dd�Z d d � Z d d � Z dS )rf r� r� r� r) )� sso_start_urlr� � sso_role_name�sso_account_idNc C s@ |d u rt | j�}|| _|d u r$i }|| _|| _|| _|| _d S r+ )r� �_SSO_TOKEN_CACHE_DIR� _token_cacher) rF r rE )rS r3 r4 r5 r) re r- r- r0 rT s zSSOProvider.__init__c s� | � � }|�di �}| j}|�| ji �� t� fdd�| jD ��rDd S i }g }| jD ]$}|� v rl� | ||< qR|�|� qR|r�d�|�}td||f d��|S )NrZ c 3 s | ]}|� vV qd S r+ r- )r� �c�r[ r- r0 r� % r2 z/SSOProvider._load_sso_config.<locals>.<genexpr>r� zSThe profile "%s" is configured to use SSO but is missing required configuration: %sr� )rF r= rE �all�_SSO_CONFIG_VARSr? r� r )rS r� rZ r5 r' Zmissing_config_varsZ config_var�missingr- r� r0 �_load_sso_config s( ��z SSOProvider._load_sso_configc C sR | � � }|sd S t|d |d |d |d | jt| jd�| jd�}t| j|jd�S )Nr� r� r� r� )r) )r� r) r_ ) r� r� r r r� r) r� r@ r )rS Z sso_configZ sso_fetcherr- r- r0 r� ; s � �zSSOProvider.load)NN) rh ri rj r@ r� r� r� r� r� r� rT r� r� r- r- r- r0 rf s � � rf )NN)F)Pr rn �loggingr� r' r� r� rR � collectionsr �copyr �hashlibr Zdateutil.parserr Z dateutil.tzr r Zbotocore.configloaderr� Zbotocore.compatr r r Zbotocore.configr Zbotocore.exceptionsr r r r r r r r r Zbotocore.utilsr r r r r � getLoggerrh rH r rN r� rA rm rp rs rw rC r� r� r� r| r� r� r� r r# r8 r= r] r@ r> rE r` rc rF rB rd rD r? rJ r� rf r- r- r- r0 �<module> s� � UD -' E1P �9-F t"*7* 7YXEdH
| ver. 1.1 | |
.
| PHP 8.3.30 | Ð“ÐµÐ½ÐµÑ€Ð°Ñ†Ð¸Ñ Ñтраницы: 0 |
proxy
|
phpinfo
|
ÐаÑтройка